Keystone said attackers exploited a third party data monitoring tool on its official website, detected Oct. 20 and confirmed Oct. 23 after checking API activity with Shopify. Keystone's announcement

Of 51,083 Shopify buyer records, 25,964 from 2024 to 2026 still held names, contact details, shipping addresses and order items and prices, plus 12,873 incomplete checkout records with names and contact and shipping info. 25,119 older records had already been erased and anonymized. Amazon and other channels were not affected. Keystone blamed failed bulk erasure past its 180 day policy, and on Oct. 24 requested erasure of buyer data over 90 days and checkout data over 30 days, with Shopify completion expected Nov. 3. Keystone's article

Attackers also took a WebAuth device authentication key that could let fake wallets pass official authenticity checks. Keystone will destroy 18,835 unsold old key devices, pause unshipped orders and move new production to a replacement key. Old key wallets received after Oct. 20 need extra checks even if they pass online verification. WuBlockchain

Seed phrases, private keys, wallet credentials, bank payment info, ID numbers and transaction signing were not compromised. Keystone blocked access, fixed the flaw and is emailing affected users. Do not share phrases or keys, enter a phrase into a device you did not order, or click links in unexpected messages. Keystone says it will never ask for phrases or keys. Type keyst.one yourself and contact [email protected] if unsure. Keystone's article